{"metadata": {"vulnerability": "CVE-2026-92798", "count": 17, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-16T19:44:13.265Z", "date_only": false, "value": "2026-09-16T19:44:13.265Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-92798", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-16T19:59:06Z", "date_only": false, "value": "2026-09-16T19:59:06.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-92798", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-16T14:42:54Z", "date_only": false, "value": "2026-10-16T14:42:54.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-92798", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-17T03:43:31.068Z", "date_only": false, "value": "2026-10-17T03:43:31.068Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-92798", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-17T03:43:31.068Z", "date_only": false, "value": "2026-10-17T03:43:31.068Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-92798", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-17T03:57:38.736Z", "date_only": false, "value": "2026-10-17T03:57:38.736173Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117454239055106072", "record": "CVE-2026-92798", "field": "creation_timestamp", "uuid": "cfc0ece0-cfa5-4f25-a77d-0cca3caf6b44", "content": "CVE-2026-92798 User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() \u2014 which does not strip WordPress shortcode delimiters \u2014 before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.\nhttps://www.cve.org/CVERecord?id=CVE-2026-92798https://www.wordfence.com/threat-intel/vulnerabilities/id/ec317df9-c7ef-49a3-9818-903dfe4bdd03?source=cvehttps://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/class-ur-smart-tags.php#L475https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/class-ur-smart-tags.php#L474https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/modules/content-restriction/class-urcr-frontend.php#L1383https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/modules/content-restriction/functions-urcr-core.php#L693https://plugins.trac.wordpress.org/changeset/3741339/user-registration/trunk/includes/class-ur-smart-tags.php#wordpress #wpeverest #UserRegistration&Membership\u2013Free&PaidMemberships,Subscriptions,ContentRestriction,UserProfile,CustomUserRegistration&LoginBuilder#CVE_2026_92798#bot", "url": "https://infosec.exchange/users/cve/statuses/117454239055106072"}, {"timestamp": "2026-10-17T04:17:10Z", "date_only": false, "value": "2026-10-17T04:17:10Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FC28-R9M2-C784", "record": "GHSA-FC28-R9M2-C784", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-17T04:17:10.257Z", "date_only": false, "value": "2026-10-17T04:17:10.257", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-92798", "record": "FKIE_CVE-2026-92798", "field": "published"}, {"timestamp": "2026-10-17T06:04:48.988Z", "date_only": false, "value": "2026-10-17T06:04:48.988846Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3my2gbhysni2s", "record": "CVE-2026-92798", "field": "creation_timestamp", "uuid": "6ece2ba6-92a0-4007-91a5-d914c4f607a9", "content": "\ud83d\udfe0 CVE-2026-92798 - High (8.1)\n\nThe User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Exec...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-92798/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3my2gbhysni2s"}, {"timestamp": "2026-10-17T06:30:33Z", "date_only": false, "value": "2026-10-17T06:30:33Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FC28-R9M2-C784", "record": "GHSA-FC28-R9M2-C784", "field": "published"}, {"timestamp": "2026-10-17T06:30:33Z", "date_only": false, "value": "2026-10-17T06:30:33Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FC28-R9M2-C784", "record": "GHSA-FC28-R9M2-C784", "field": "modified"}, {"timestamp": "2026-10-18T11:07:46.822Z", "date_only": false, "value": "2026-10-18T11:07:46.822643Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-92798", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-18T11:07:46.822Z", "date_only": false, "value": "2026-10-18T11:07:46.822643Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-92798", "record": "FKIE_CVE-2026-92798", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-18T11:22:46.165Z", "date_only": false, "value": "2026-10-18T11:22:46.165Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-92798", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-18T11:22:46.165Z", "date_only": false, "value": "2026-10-18T11:22:46.165Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-92798", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T00:00:17.248Z", "date_only": false, "value": "2026-10-19T00:00:17.248617Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3my6stiww7c2x", "record": "CVE-2026-92798", "field": "creation_timestamp", "uuid": "7e1f6cba-4105-4bdc-9783-438e7c52c00c", "content": "CVE-2026-92798. CVSS 8.1. User Registration & Membership plugin lets attackers execute arbitrary code via HTTP headers. Your site config and database exposed. No patch available. Disable the plugin now. Scan: pulse-wp.com\n#WordPress #CVE #CyberSecurity", "url": "https://bsky.app/profile/pulse-wp.com/post/3my6stiww7c2x"}, {"timestamp": "2026-10-19T15:16:45.150Z", "date_only": false, "value": "2026-10-19T15:16:45.150", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-92798", "record": "FKIE_CVE-2026-92798", "field": "lastModified"}]}